ABSTRACT 


A method that protects computer data from untrusted programs. Each computer's object and 
process is assigned with trust attributes, which define the way it can interact with other objects 
within the system. The trust attributes are defined hierarchically so that processes cannot access 
objects with higher trust levels than themselves. When accessing objects with lower trust levels, 
processes can see their trust levels lowered to that of the object accessed. The interaction 
between processes and objects of different levels is entirely programmable. 
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